Critical Cisco ISE Vulnerabilities Allow Remote Command Execution

Cisco disclosed two serious vulnerabilities in Identity Services Engine (CVE-2026-20181 and CVE-2026-20190). CVE-2026-20181 (CVSS 9.1) can allow authenticated administrators to send crafted HTTP requests and potentially escalate to root; CVE-2026-20190 (CVSS 7.5) can allow unauthenticated access to sensitive information such as hashed credentials. Cisco has published patches and urges immediate updating; ISE-PIC has reached end-of-sale and no active exploitation has been reported.